Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,159All CVEsplus 19,142 rejected
- 204Last 24 hours3,228 in the last 7 days
- 16,874Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 5 | 47 | 1 | 0 | 57 | 86 |
| 2025 | 0 | 5 | 9 | 0 | 0 | 14 | 29 |
| 2024 | 2 | 0 | 4 | 1 | 0 | 7 | 15 |
| 2023 | 1 | 3 | 4 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-108705 | CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/importPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-108704 | CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add EndpointsPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-108703 | CordysCRM through 1.9.3 Missing Authorization via /approval-resource/pushPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-108702 | CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook TestPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-108701 | 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sortPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-108700 | 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-titlePublic exploit1Panel-dev · CordysCRM | High7.1 |
| CVE-2026-108692 | 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source EndpointsPublic exploit1Panel-dev · CordysCRM | High7.1 |
| CVE-2026-79919 | MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)1Panel-dev · MaxKB | Medium6.3 |
| CVE-2026-79918 | MaxKB: Sandbox escape via unhooked fexecve1Panel-dev · MaxKB | Medium6.3 |
| CVE-2026-77517 | MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge basePublic exploit1Panel-dev · MaxKB | Medium5.4 |
| CVE-2026-77521 | MaxKB: Prompt-injectable agent can lead to command executionPublic exploit1Panel-dev · MaxKB | Critical10.0 |
| CVE-2026-77522 | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)Public exploit1Panel-dev · MaxKB | Medium4.3 |
| CVE-2026-79917 | MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation1Panel-dev · MaxKB | Medium6.5 |
| CVE-2026-77516 | MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch pathPublic exploit1Panel-dev · MaxKB | Medium5.4 |
| CVE-2026-77523 | MaxKB: Cross-workspace model parameter form write1Panel-dev · MaxKB | High7.4 |
| CVE-2026-77525 | MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_idPublic exploit1Panel-dev · MaxKB | Medium4.2 |
| CVE-2026-77518 | MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflowsPublic exploit1Panel-dev · MaxKB | Medium5.0 |
| CVE-2026-79916 | MaxKB AWS Bedrock model credential injection leads to remote code execution1Panel-dev · MaxKB | Critical9.1 |
| CVE-2026-77520 | MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application1Panel-dev · MaxKB | Medium5.4 |
| CVE-2026-77519 | MaxKB: Expired application API keys remain usable on `/chat/api/mcp`Public exploit1Panel-dev · MaxKB | Medium5.4 |
| CVE-2026-76899 | CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`1Panel-dev · CordysCRM | Medium5.7 |
| CVE-2026-76902 | CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`1Panel-dev · CordysCRM | Medium5.0 |
| CVE-2026-76900 | CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at RuntimePublic exploit1Panel-dev · CordysCRM | Medium6.8 |
| CVE-2026-76901 | CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts1Panel-dev · CordysCRM | Medium5.8 |
| CVE-2026-63647 | CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`Public exploit1Panel-dev · CordysCRM | Critical9.3 |
| CVE-2026-63646 | CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous UsersPublic exploit1Panel-dev · CordysCRM | Medium6.9 |
| CVE-2026-52745 | CordysCRM: Customer Public Pool Sorting Field SQL Injection1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-65956 | KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF1Panel-dev · KubePi | Critical10.0 |
| CVE-2026-69129 | KubePi: Insufficient per-cluster authorization checks in cluster management APIs1Panel-dev · KubePi | Medium5.8 |
| CVE-2026-64870 | MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validationPublic exploit1Panel-dev · MaxKB | Medium5.3 |
| CVE-2026-16223 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-16222 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryPublic exploit1Panel-dev · CordysCRM | Medium5.3 |
| CVE-2026-54149 | MaxKB MCP tool import validation bypass allows post-authentication remote code executionPublic exploit1Panel-dev · MaxKB | High8.8 |
| CVE-2026-56779 | MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url ParametersPublic exploit1Panel-dev · MaxKB | Medium5.3 |
| CVE-2026-10567 | 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scriptingPublic exploit1Panel-dev · CordysCRM | Medium5.1 |
| CVE-2026-10514 | 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scriptingPublic exploit1Panel-dev · CordysCRM | Medium4.8 |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch1Panel-dev · MaxKB | Medium5.1 |
| CVE-2026-42337 | MaxKB: Broken Access Control in MaxKB OSS URL Fetch API1Panel-dev · MaxKB | Medium5.3 |
| CVE-2026-44847 | MaxKB: Webhook Trigger Authentication Bypass1Panel-dev · MaxKB | High7.5 |
| CVE-2026-45412 | MaxKB: Unauthenticated SSRF via Workflow Template Import1Panel-dev · MaxKB | Medium6.3 |
| CVE-2026-45413 | MaxKB: Unsalted MD5 Password Hashing1Panel-dev · MaxKB | Medium6.9 |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy1Panel-dev · MaxKB | Medium6.3 |
| CVE-2026-39426 | MaxKB: Stored XSS via Unsanitized iframe_render Parsing1Panel-dev · MaxKB | Medium5.1 |
| CVE-2026-39425 | MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering1Panel-dev · MaxKB | Medium5.1 |
| CVE-2026-39419 | MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing1Panel-dev · MaxKB | Low3.1 |
| CVE-2026-39424 | MaxKB has CSV Injection in its Application Chat Export Functionality1Panel-dev · MaxKB | Medium5.3 |
| CVE-2026-39423 | Stored XSS via Eval Injection in EchartsRander Component1Panel-dev · MaxKB | Medium6.9 |
| CVE-2026-39422 | MaxKB has Stored XSS via ChatHeadersMiddlewarePublic exploit1Panel-dev · MaxKB | Medium6.9 |
| CVE-2026-39421 | MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect1Panel-dev · MaxKB | Medium6.3 |
| CVE-2026-39420 | MaxKB: Sandbox escape via LD_PRELOAD bypass1Panel-dev · MaxKB | Medium6.3 |